" hipaa Archives - LuxSci

Posts Tagged ‘hipaa’

Is Medical Billing Information Protected Under HIPAA?

Tuesday, August 9th, 2022

Electronic medical billing requires access to protected health information to accurately bill and receive payment for medical treatments. While not covered entities, medical billing companies are often contracted as business associates and fall under HIPAA regulations.

Title II of HIPAA applies directly to medical billing companies. It dictates the proper uses and disclosures of protected health information (PHI) and simplifies claims and billing processing.

electronic medical billing

What is Protected Health Information (PHI)?

Protected health information is “individually identifiable” health information. It specifically refers to three classes of data:

  1. An individual’s past, present, or future physical or mental health or condition.
  2. The past, present, or future provisioning of health care to an individual.
  3. The past, present, or future payment-related information for the provisioning of health care to an individual.

As listed in item three, payment-related information tied to healthcare provisioning is protected data under HIPAA. This can include information about insurance carriers and payments, billing statements, receipts, credit card numbers, bank accounts, and other financial information.

To be classified as PHI, payment-related information must be tied to an individual identifier. For example, a medical bill with a patient’s address can be tied back to a specific individual. These identifiers can sometimes be quite indirect. There are 18 types of identifiers for an individual (listed below). Any of one of these, combined with information on healthcare payments, would constitute PHI:

  • Name
  • Address (all geographic subdivisions smaller than a state, including street address, city, county, zip code)
  • All elements (except years) of dates related to an individual (including birth date, admission date, discharge date, date of death, and exact age if over 89)
  • Telephone number
  • Fax number
  • Email address
  • Social Security number
  • Medical record number
  • Health plan beneficiary number
  • Account number
  • Certificate/license number
  • Any vehicle or other device serial number
  • Device identifiers or serial numbers
  • Web URL
  • Internet Protocol (IP) address numbers
  • Finger or voiceprints
  • Photographic images
  • Any other characteristic that could uniquely identify the individual

The Risks to Medical Billing Companies

It should be evident that medical billing companies work with a lot of PHI. As such, they must take steps to protect that information under HIPAA regulations.

Third-Party Risk

Many healthcare systems contract medical billing companies to process claims and bill patients and insurance companies. These companies can present significant risks to protected health information if not adequately vetted. All third-party companies that handle PHI on behalf of a covered entity must sign a business associate agreement. This document discusses how sensitive medical billing information will be stored, secured, and transmitted. It is also essential to ensure that the billing companies understand their obligations under the privacy and security rules and have implemented the proper physical, technical, administrative, and organizational standards. This can be verified via security audits and assessments.

Third parties like medical billing companies are often targets for cyberattacks. From 2020 to 2021, cyberattacks on business associates increased by 18%. The rich trove of financial and health data they have is often more comprehensive and less secure than a hospital’s electronic health records system. Unlike covered entities who frequently work under HIPAA regulations, third parties may not wholly understand it. As a result, they may fail to take the technical steps needed to secure sensitive data.

How to protect electronic medical billing information

Like many healthcare organizations, financial institutions are also undergoing digital transformation and are moving to digitize healthcare payment processes. Digitization is an effective way to reduce payment times and improve patient satisfaction. However, it also introduces risk. Digital systems that contain healthcare billing information must implement the proper safeguards, including:

  • Organizational requirements that describe how policies and procedures will be implemented and obligations concerning business associate contracts.
  • Administrative requirements related to how employees access PHI.
  • Physical safeguards that encompass the security of computer systems, servers, and networks, access to the facility and workstations, data backups and storage, and the destruction of obsolete data.
  • Technical safeguards that ensure the security of data transmitted over an open electronic network and the storage of that data.

Protecting Electronic Medical Billing Information In Databases

Digital billing information that is stored in electronic databases or online web portals must be secured in the following ways:

  • Using a secure and HIPAA-compliant web and database host.
  • Limiting access to only authorized users.
  • Requiring unique logins and complex passwords with multifactor authentication to access ePHI.
  • Encrypting the contents of the database so they cannot be accessed if there is a breach.
  • Making regular backups of the database and storing them independently of the main system.

Sending Healthcare Billing Notifications Digitally

Many people now prefer to receive electronic medical billing notifications via email. A survey of 3,000 US consumers found that 85% are already using e-billing, and 47.6% find it is faster to pay bills electronically. However, using email, text messaging, or other digital communication forms introduces new risks and requires remediation to protect ePHI in transmission. These safeguards include:

  • Encrypting messages in transit
  • Authenticating user identities and sending domains
  • Requiring unique user logins and complex passwords
  • Protecting against threats with anti-virus software, email filtering, and other malicious scanning tools.
  • Creating audit logs and reviewing them for suspicious activities.

Services like LuxSci’s Secure High Volume Email can integrate with existing systems to send automated encrypted billing notifications via API or SMTP.

Is Email Archival Required by HIPAA?

Tuesday, April 5th, 2022

Customers often inquire if email archival is required by HIPAA regulations.

There is a great deal of confusion and uncertainty here because:

  1. HIPAA lists many requirements, but does not provide specific instructions on how to implement them. It’s ambiguous, but provides a great deal of flexibility for organizations.
  2. Email archival adds a fixed cost to any email solution – and everyone prefers to avoid unnecessary costs.
  3. Many organizations want to do the minimum needed for compliance due to time and budgetary constraints.

email archival hipaa

In our opinion, email archival is an implicit requirement of HIPAA for all organizations that send ePHI via email. In the next section, we’ll review why.

Read the rest of this post »

Promoting Health Literacy with Email Engagement

Tuesday, March 29th, 2022

In the final installment of our series on using digital technology for patient engagement, we discuss how email can promote health literacy and help patients manage chronic conditions.

health literacy

Patient Education and Health Literacy

Chronic diseases like diabetes and heart disease require a high degree of health literacy to manage effectively at home. Health literacy is the ability to understand, engage, and act upon health information. Researchers from the Mayo Clinic found that heart failure patients with lower levels of health literacy saw higher hospital admission and mortality rates. Therefore, boosting levels of health literacy for chronic disease patients is essential to improving health outcomes.

Of course, patient education and health literacy start with the in-person interactions a patient has with their health care provider. However, once a patient leaves the office, education should not stop. Using digital channels to reinforce medical messaging and can help keep patients up to date with developments in their treatment plans and prognosis.

Email is an excellent way to engage patients. It is minimally intrusive and asynchronous, meaning patients can read the material whenever it is convenient for them. Better yet, email messages can be personalized to meet the needs of individual patients with minimal time and effort.

Email Campaign Examples to Promote Health Literacy

To illustrate how email can improve health literacy, let’s take an example. A patient recently diagnosed with diabetes has a lot to learn about managing their health. Diabetes is a chronic condition that requires substantial lifestyle changes. Non-adherence to treatment can have serious consequences, including hospitalization and death. A patient is likely to meet with a health care provider on a regular basis to discuss their treatment plan, but the amount of information can be overwhelming. Sending follow up emails that reiterate important information can help patients understand and absorb the messaging received from their doctor.

Some potential campaign ideas include:

  • how to use insulin pumps
  • managing blood sugar
  • what to do if blood sugar is too low or too high
  • learning about A1C levels
  • information on preventing serious complications
  • information on nutrition and meal planning
  • exercise ideas
  • sharing information about diabetes support groups and events

Being diagnosed with a chronic health condition can have serious mental health impacts. Helping patients feel supported with resources and access to medical information throughout the lifestyle changes is very important.

Personalizing Email Campaigns

Here comes our regular reminder: sending emails that contain ePHI like those mentioned above, need to comply with HIPAA. Once HIPAA requirements are met, organizations can personalize emails with patient data. In addition to sending medical information, campaigns can be personalized further using demographic data.

Patients that suffer from chronic conditions and are members of ethnic minority groups often experience worse health outcomes than their white counterparts. To address health equity issues, use segmentation to target select groups with messaging specific to their needs. This could include creating campaigns in multiple languages, addressing diet and exercise tips in a culturally sensitive way, or providing more resources to help these groups afford testing and insulin.

The power of email personalization allows health care providers to provide accurate and timely information to their patients.

Conclusion

Learning to live with a chronic health condition is not an easy task. To help prevent hospital visits and deteriorating health, promoting health literacy is essential. Supplementing doctor visits with personalized email campaigns can help answer patient questions and help them adjust to living with a chronic illness. Contact LuxSci today if you would like to learn more about HIPAA-compliant email marketing campaigns.

Does TLS Email Encryption Meet Compliance Requirements?

Tuesday, February 22nd, 2022

In this article, we discuss what types of email encryption are sufficient to comply with government regulations. TLS encryption is a good option for many organizations dealing with sensitive data and legal requirements. However, TLS does not protect data at rest. Each organization must undertake their own risk assessment to determine which encryption methods are suitable to fulfill legal requirements.

Read the rest of this post »

Email Encryption for HIPAA Compliance: SMTP TLS vs Portal Pick Up

Tuesday, February 15th, 2022

Email encryption is an addressable standard for HIPAA compliance, but that doesn’t mean it’s optional. When sending sensitive data via email, it should be protected with encryption. However, there are many ways to send a secure email message and HIPAA does not require the use of a specific method.

The two most common email encryption methods include SMTP TLS and Secure Portal Pick Up. This article will discuss the differences between them and provide guidance for what to use in a HIPAA compliance context.

email encryption for hipaa

Read the rest of this post »